- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2
by Ramon F McDougall 08 Apr '13

08 Apr '13

Greetings to All, I need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and decided to try syslog-ng to work under this environment. I’m not 100% sure(trying to learn about all these things) that it’s working the way it’s supposed to. I followed an example detailed in this link: http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html It’s my hope that someone with much more expertise than I share some of their knowledge so that I can get this working. I have configured the firewall to send to my syslog server v3.1.4. Does anyone have this working on OpenBSD and can share their config files? $ cd syslog-ng syslog-ng.conf syslog-ng.conf.original $ more syslog-ng.conf # syslog-ng configuration file for OpenBSD. # This should provide the same behavior as OpenBSD's syslog.conf(5). # 2010-07-18 steven(a)openbsd.org @version: 3.0 options { use_dns(no); create_dirs(no); keep_hostname(yes); }; source s_local { unix-dgram ("/dev/log"); unix-dgram ("/var/empty/dev/log"); internal(); }; #source s_local_all { # unix-dgram ("/dev/log"); # unix-dgram ("/var/empty/dev/log"); # unix-dgram ("/var/www/dev/log"); # internal(); #}; #source s_net { # udp(port(514)); #}; destination d_console { file("/dev/console"); }; destination d_messages { file("/var/log/messages" owner(root) group(wheel) perm(0644)); }; destination d_authlog { file("/var/log/authlog" owner(root) group(wheel) perm(0640)); }; destination d_secure { file("/var/log/secure" owner(root) group(wheel) perm(0600)); }; destination d_cronlog { file("/var/cron/log" owner(root) group(wheel) perm(0600)); }; destination d_daemon { file("/var/log/daemon" owner(root) group(wheel) perm(0640)); }; destination d_xferlog { file("/var/log/xferlog" owner(root) group(wheel) perm(0640)); }; destination d_lpderrs { file("/var/log/lpd-errs" owner(root) group(wheel) perm(0640)); }; destination d_maillog { file("/var/log/maillog" owner(root) group(wheel) perm(0600)); }; destination d_uucplog { file("/var/log/uucp" owner(uucp) group(dialer) perm(0660)); }; destination d_sudolog { file("/var/log/sudo"); }; destination d_chatlog { file("/var/log/chat"); }; destination d_ttyall { usertty("*"); }; destination d_ttyroot { usertty("root"); }; destination d_loghost { udp("loghost" port(514)); }; destination d_network_hosts { file ("/var/log/bcm/$HOST.log"); }; filter f_notice { level(notice .. emerg) and not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); }; filter f_kerndebug { level(debug .. emerg) and facility(kern); }; filter f_msginfo { level(info .. emerg) and facility(syslog,user); }; filter f_authinfo { level(info .. emerg) and facility(auth); }; filter f_authprivdebug { level(debug .. emerg) and facility(authpriv); }; filter f_croninfo { level(info .. emerg) and facility(cron); }; filter f_daemoninfo { level(info .. emerg) and facility(daemon); }; filter f_ftpinfo { level(info .. emerg) and facility(ftp); }; filter f_lprdebug { level(debug .. emerg) and facility(lpr); }; filter f_mailinfo { level(info .. emerg) and facility(mail); }; filter f_uucpinfo { level(info .. emerg) and facility(uucp); }; filter f_emerg { level(emerg); }; filter f_to_console { not (facility(authpriv)) and ((level(notice .. emerg) and facility(auth)) or (level(debug .. emerg) and facility(kern)) or (level(crit .. emerg) and facility(mail)) or level(err .. emerg)); }; filter f_to_root { (level(debug .. emerg) and facility(auth)) or (level(notice .. emerg)); }; filter f_to_loghost { (level(notice .. emerg) and not (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) or (level(info .. emerg) and facility(auth,daemon,syslog,user)) or (level(debug .. emerg) and facility(authpriv,kern)); }; filter f_prog_sudo { program("sudo"); }; filter f_prog_chat { program("chat"); }; log { source(s_local); filter(f_notice); destination(d_messages);}; log { source(s_local); filter(f_kerndebug); destination(d_messages);}; log { source(s_local); filter(f_msginfo); destination(d_messages);}; log { source(s_local); filter(f_authinfo); destination(d_authlog); }; log { source(s_local); filter(f_authprivdebug); destination(d_secure); }; log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; # Uncomment this line to send "important" messages to the system # console: be aware that this could create lots of output. #log { source(s_local); filter(f_to_console); destination(d_console); }; # Uncomment this to have all messages of notice level and higher # as well as all authentication messages sent to root. #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; # Everyone gets emergency messages. log { source(s_local); filter(f_emerg); destination(d_ttyall); }; # Uncomment to log to a central host named "loghost". #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; # Uncomment to log messages from sudo(8) and chat(8) to their own # respective log files. Matches are done based on the program name. # Program-specific logs: #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; # Uncomment to log messages from the network. # Note: it is recommended to specify a different destination here. #log { source(s_net); destination(d_messages); }; $ syslog-ng-ctl Syntax: syslog-ng-ctl <command> [options] Possible commands are: stats Dump syslog-ng statistics verbose Enable/query verbose messages debug Enable/query debug messages trace Enable/query trace messages # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;6 src.internal;s_local#2;;a;processed;5 src.internal;s_local#2;;a;stamp;1365446582 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;7 destination;d_ttyall;;a;processed;0 # syslog-ng-ctl verbose --set=on # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;9 src.internal;s_local#2;;a;processed;8 src.internal;s_local#2;;a;stamp;1365446909 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;10 destination;d_ttyall;;a;processed;0 # Please let me know what more information you need to be able to help. Regards and Thank you,…Ramon

1 0

Getting milliseconds in logs
by Abhijeet Rastogi 05 Apr '13

05 Apr '13

Hi, I want to get a complete ISO8601 timestamp format in syslog-ng. Something like: 2013-04-04T18:44:34.694692+00:00 When I enable, ts_format("iso"), I'm not able to get milliseconds precision and what I get is something like 2013-04-05T02:57:07+00:00 For some reason, I really need milliseconds resolution. How can I achieve that in syslogn-ng? -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

3 4

how to archive logs efficiently
by Daniel Neubacher 05 Apr '13

05 Apr '13

Hey there, my syslog-ng has gotten quite big with 50k logs per second and the server seems to hit the io limit at night. While a few month ago I could run a gzip with ionice over all old logs the server doesn't like it anymore and quite a lot of logs are storing while the compression lasts. I'm using the ose so I've got no logstore. And for a second I've thought about writing the logs a compressed fuse fs but... fuse :P So how are you guys doing it? -- Daniel Neubacher, Network Administrator daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Gaensemarkt 43, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

5 7

reloading (HUP) syslog-ng -> mutilation of messages in mongodb
by Lucas, Sascha 04 Apr '13

04 Apr '13

Hi, after reloading syslog-ng 3.4.1 (SIGHUP) I have random issues with mutilation of messages to a mongodb destination. Sometimes the value of the MESSAGE key is just truncated. An other time i.e. LEGACY_MSGHDR, MESSAGE, PROGRAM are empty and the HOST value is mutilated. And sometimes syslog-ng stops inserting into mongodb. Any hints on this? TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 3

syslog-ng-ctl stats -> EOF on control channel
by Lucas, Sascha 03 Apr '13

03 Apr '13

Hi, I regularly run "syslog-ng-ctl stats" for monitoring purpose. My log-analyses shows that following messages is logged to priority err: EOF on control channel, closing connection; I would expect this with priority info. Or is there an error calling the above command? My syslog-ng version is 3.4.1. Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 1

OSE 3.4(.1) block() argument parse issue
by Eric Berggren 30 Mar '13

30 Mar '13

syslog-ng OSE 3.4.1 is unable to parse the "Example 5.8: Passing arguments to blocks" excerpt in the v3.4 admin guide, which exemplifies a common construct used in our current 3.2 config : @version: 3.4 block source s_logfile (filename("messages")) { file("/var/log/`filename`" ); }; source s_example { s_logfile(filename("logfile.log")); }; host# ./syslog-ng -s -f ./s2.conf : Error parsing affile, syntax error, unexpected LL_IDENTIFIER in source block s_logfile at line 2, column 19: included from /home/eberggren/proj/syslog-ng/config/s2.conf line 7, column 36 file("/var/log/"logfile.log ^^^^^^^^^^^ 3.3.8 appears to be okay with it, however (and our existing 3.2 config). thanks, -eric

2 2

[Bug 225] New: patterndb can not use HOST as variable in pattern
by bugzilla＠bugzilla.balabit.com 30 Mar '13

30 Mar '13

https://bugzilla.balabit.com/show_bug.cgi?id=225 Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 This fails in the patterndb test --validate with the error ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX) <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule> but this succeeds and replaces the HOST macro <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule> I would expect the both to work. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 7

How to build a filter where one message from one host not logged
by Niels Graupe 29 Mar '13

29 Mar '13

Hi ! I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile filter f_cisco_switches_knownerrors1 { host ("hostxy") and match("ENVIRONMENT-3-RPS_FAILED"); }; The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected Thanks, Niels

2 1

Closing destination file when date changes.
by andrea.meconi＠libero.it 23 Mar '13

23 Mar '13

Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS @version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);}; Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea

4 3

R: Re: Closing destination file when date changes.
by andrea.meconi＠libero.it 22 Mar '13

22 Mar '13

Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 22/03/2013 15.44 >A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] Closing destination file when date changes. > >Sandor Geller <Sandor.Geller(a)morganstanley.com> writes: > >> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi(a)libero.it >> <andrea.meconi(a)libero.it> wrote: >>> Hello. >>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS >>> >>> >>> @version: 3.3 >>> @include "scl.conf" >>> source from-network { udp(ip("0.0.0.0") port(514)); }; >>> destination local-file { >>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; >>> log { source(from-network); destination(local-file);}; >>> >>> >>> Log on a destination file using date as filename. >>> I need to close this file when date changes at 00:00. How? >> >> Unused file destinations could get reaped, see time_reap(). However >> you should take into account that the macros you used in the filename >> are dependent of keep_timestamp() and by default use the timestamp in >> the log message so the destination file could get opened when further >> logs arrive with timestamps referring to the given date... If you want >> to use files based on the receiver's time then I suggest using the R_ >> macros. > >That, and you can force syslog-ng to reinitialize the destinations by >sending it a HUP signal. So using the R_* family of macros, and sending >a SIGHUP shortly after 00:00 will result in syslog-ng closing the old >files. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0